CVE-2020-5202: Medium severity Apt-cacher-ng Project Apt-cacher-ng vulnerability
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apt-cacher-ngto a version that resolves this vulnerability.Fixed in 3.6.4-1Fixed in 3.7.4-1Fixed in 3.7.5-1Fixed in 3.7.5-1.1 - Compensating control
Prevent unprivileged local users from binding or sending requests to the hardcoded apt-cacher-ng TCP port 3142 by restricting local access to port 3142 (e.g., via local firewall/ACL) so only the apt-cacher-ng daemon and its authorized clients can use it.
- Operational
If AdminAuth is enabled in /etc/apt-cacher-ng/security.conf, rotate any credentials/secrets that could have been exposed via requests intercepted on localhost:3142 before remediation (e.g., before applying the fix/upgrade).
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-5202.
What is the severity level of CVE-2020-5202?
The severity level of CVE-2020-5202 is medium, with a severity value of 5.5.
How can local users exploit CVE-2020-5202?
Local users can exploit CVE-2020-5202 by hijacking the hardcoded TCP port used by the /usr/lib/apt-cacher-ng/acngtool program.
Which software versions are affected by CVE-2020-5202?
The affected software versions include apt-cacher-ng versions 3.2.1-1, 3.6.4-1, and 3.7.4-1.
Where can I find more information about CVE-2020-5202?
You can find more information about CVE-2020-5202 at the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html), [Reference 3](http://www.openwall.com/lists/oss-security/2020/01/20/4).